CoreTech Coffee – Safeguard Your M365 Tenant After Offboarding

When it comes to the automation of onboarding and onboarding, these two topics are quite tedious. Half of the companies either have processes that are half automated or not at all.

It can be hard because you have to do so many things to do a full onboarding process: 

• Get approval
• Create an account
• Manage the password
• Assign the right license.
• Do not make any mistakes.
• Set up quotas.

Offboarding is an important topic because it covers security and savings.

Because you want to secure your environment and you don't want someone to have a license when they have left.

But let's take a quick look at what Microsoft recommends in terms of best practices for offboarding:

1. Prevent the person from logging in, right? That's onboarding 101, you don't want them to log back in.
2. Set the content of their mailbox-forward their emails to someone else like their manager or their colleagues.
3. Give access to Outlook/OneDrive to the manager - because some very important documents may be shared.
4. Wipe and block their mobile devices

Why Offboarding Office 365 Users Can Be Dangerous

Here are two consequences of not deprovisioning accounts.

1. A former employee of Cisco deleted 456 virtual machines when he left the company.
2. Another former employee wiped 21 gigabytes of vital data from her previous company out of anger

How to Onboard Office 365 Users in CoreView

1. Hit create
2. Some variables the operator will need to create a user are: last name, first name, department
3. Create a list of "IT finance sales"
4. Use the dropdown and get data into the back end of CoreView, to retrieve all the user principle names. This way, I'll be able to assign someone from the drop-down list and pick someone with no typos

So where do I start?

1. Ask the soon-to-be manager, if he or she agrees with the creation of this account.
2. Send that person an email saying, "Do you acknowledge the creation of that new account?"
3. Send an email new account. "Hi, we are going to create an account for your new team member. And I'm going to use the user's last name and first name."
4. If that person says yes in the email, There will be two options at the bottom of the email.
5. Yes. The workflow continues.
6. No, it stops then
7. If that person hit, yes.
8. Create the user account and match all the things we need.
9. Type in a password
10. The next step is to manage the license
11. Use the license templates and stick with E3s only.
12. Pre-provision their OneDrive environment.
13. Make a filter here and apply your quota only for IT people.
14. Provisioning a mailbox can take some time
15. I'm going to add a step that's called check if the mailbox exists. So as long as the mailbox doesn't exist, I'm not going to move forward.
16. Enable the mailbox audit, which is something quite important these days to be able to track what's happening in mailboxes.
17. Send the welcome email

With CoreView you can do over an over 15-step workflow in a matter of minutes.

How to Decommission an Office 365 Users in CoreView

So all my users have been properly created, thanks to my onboarding workflow so I can choose to execute a workflow from reports. And I'm going to only need the user principle name.

1. Ask the manager if the account should be deleted
2. Send an email saying this account is going to be deleted
3. Block the sign-in and prevent the user from accessing the data
4. Actions >Phase 65 user
5. Edit the sign-in status
6. Block the credentials
7. Remove all the sessions for the user
8. Convert the mailbox to a shared mailbox
9. Put in the auto-reply.
10. Add the manager as the OneDrive owner

With CoreView you can now delegate workflows to someone and run that workflow to ensure consistency.

That's the beauty of CoreView it's consistent and workflows are 24/7/365.

So that's how we can match very easily with CoreView and Microsoft's best practices in terms of decommissioning and deprovisioning users.

Frequently Asked Questions

How does onboarding or offboarding work in hybrid environments where a user needs to be deleted from on-premises?

CoreView has a hybrid connector that allows us to run actions against, on-premise environments. So we can delete Active Directory accounts from CoreView through that agent.

Could we similarly have users from on-premises?

Yes, you could with the hybrid connector we can leverage the identity management from Active Directory.